GroupPolicy/Registry issue
My MDR product is having an issue with scanning the registry of our hosts. It times out and causes performance issues, essentially bringing down the host. I opened a case with their support and we narrowed the issue down to this reg key: Computer\HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects There are hundreds of sub keys, each with their own sub keys. It seems each time group policy is applied to the host, 2 new keys are created, a machine and a user key. As a test, I deleted everything under the main key and rebooted. After logging back in, 2 new keys had been created. After a day I checked again and there were a dozen or more. Now after a few weeks we're back up to hundreds. Does anyone have any ideas as how to automatically clean up the older entries to keep the number to a minimum? Or is there a way to stop this behavior? Thanks
Interface Views in Microsoft 365 Admin Center
1. Simplified View Purpose: Designed for small businesses or organizations with limited IT resources. Features: Streamlined dashboard with essential tasks like user management, license assignment, and password resets. Minimal configuration options to reduce complexity. Quick access to support and basic service health info. Use Case: Ideal for admins who need to perform routine tasks without diving into advanced settings. 2. Dashboard View (Advanced View) Purpose: Tailored for medium to large enterprises with complex IT environments. Features: Full access to all admin centers (Exchange, SharePoint, Teams, etc.). Advanced analytics, reporting, and configuration tools. Role-based access control and security management. Customizable widgets and navigation for personalized workflows. Use Case: Suitable for IT teams managing multiple services, users, and compliance requirements. Customization Needs Are there specific tasks we perform frequently that can be automated in the dashboard?AVD with FSLogix - profiles not loading
Setup AVD with FSLogix several months back and profiles had been loading fine. About a month ago, profiles stopped loading and the logs show "Account restrictions are preventing this user from signing in. For example: blank passwords aren't allowed, sign-in times are limited, or a policy restriction has been enforced." This is in regards to connecting to the profile share path. If I manually try to go to that path, I receive the same error. The accounts do have a password, so it shouldn't be anything to do with a blank password. There are no sign-in time restrictions enforced on these accounts. What's left is a "policy restriction", which is kind of vague. Things I've tried: update to latest FSLogix verify permissions on profile storage enabled these in local policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options ‘Accounts: Limit local account use of blank passwords to console logon only‘ = disabled Computer Configuration > Administrative Templates > System > Credentials Delegation ‘Restrict delegation of credentials to remote servers‘ = disabled I have a ticket open with MS support for 3 weeks now, but thus far they've been completely useless.
Microsoft Edge - Welcome screen vs. don't show policy
Hi, We have a GPO that disables the Edge welcome screen (sets the SOFTWARE\Policies\Microsoft\Edge key's HideFirstRunExperience variable to 1). On some of our PC's when the user try to run Edge, they get a blank page with invalidurl error. This white page can not be closed, only way to dismiss if you stop edge processes with the taskmanager. If you set the registry value to 0, then it can reach the welcome screen and you have to do the first steps. This policy should disable the welcome screen and not just hrowing an error. how could we avoid this screen to appear? Is there any setting that let Edge think it was already started and omits this screen completely? Why did this bug appeared in the first place? This policy was working for years now, and only show this bug randomly. Edge - stable, latest version; Windows10 22H2;Group Policy object did not apply because failed error code:0x80070709 The printer name is invalid
Hi Everyone, I have a few AVD pools where we publish an app for users to access. Users report that printers are not being mapped after login. We use GPP user side to map printers and set as default. Many a times we see these events logged: VALUE>The printer name is invalid.</VALUE></PROPERTY>-</INSTANCE> Event ID 4098 is logged in the Application Log: Log Name: Application Source: Group Policy Printers Date: <DateTime> Event ID: 4098 Task Category: (2) Level: Warning Keywords: Classic User: SYSTEM Computer: server.fabrikam.com Description: The user 'HP Printer' preference item in the 'Define Printers {XXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}' Group Policy object did not apply because it failed with error code '0x80070709 The printer name is invalid.' This error was suppressed. For this one I found this https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/group-policy-printer-preferences-not-set-default-printer#resolution which is really not helpful since there is no possible solution as the client is a AVD VM and used by many users at the same time. VALUE> No printers were found.' VALUE></PROPERTY>-</INSTANCE> Event ID 4098 is logged in the Application Log: Log Name: Application Source: Group Policy Printers Date: <DateTime> Event ID: 4098 Task Category: (2) Level: Warning Keywords: Classic User: SYSTEM Computer: server.fabrikam.com Description: The user 'Accounts - Main Printer' preference item in the 'Printers - Global {zzzzzzzzzzzzzzzzzzzzz}' Group Policy Object did not apply because it failed with error code '0x80070bc4 No printers were found.' This error was suppressed. VALUE>The specified printer has been deleted.</VALUE></PROPERTY>-</INSTANCE> Event ID 4098 is logged in the Application Log: Log Name: Application Source: Group Policy Printers Date: <DateTime> Event ID: 4098 Task Category: (2) Level: Warning Keywords: Classic User: SYSTEM Computer: server.fabrikam.com Description: The user 'Sales-Printer' preference item in the 'Printers - Global {zzzzzzzzzzzzzzzzzzzzz}' Group Policy Object did not apply because it failed with error code '0x80070771 The specified printer has been deleted.' This error was suppressed. No KB's or posts out there to help with these 2 errors. Really need assistance and printers are not being mapped on first logon, users need to come out of AVD and go back and relaunch the app to see the printers mapped. This is the same case with our internal app or Notepad. Thanks, M
Unusual Behavior using GPO PowerShell Scripts During Restart/Shutdown in Hyper-V – Need Help
I have noticed strange behavior in Hyper-V. Group Policy is configured to execute PowerShell scripts for logon, logout, startup, and shutdown. The typical sequence of script execution is: startup → logon → logout → shutdown. However, an issue arises when a restart is initiated while logged in (i.e., after startup and logon scripts have already been executed). Upon clicking the restart button from the GUI, the following occurs: after the logout and shutdown scripts run as expected, the startup script is executed and the logon script (!) is triggered. This happens despite the fact that the lock screen is displayed after the restart, and no user has logged in yet. This phenomenon consistently occurs when restarting or shutting down from the GUI while logged in. It does not occur when restarting via the command line using shutdown /r /t 0 or shutting down with shutdown /s /t 0. Why does Hyper-V behave in this inexplicable manner, executing the logon script in such cases? Is it possible to configure something within the virtual machine to address this issue? Or are there specific Group Policies for script execution that could control this behavior? Could there be certain Registry entries that influence the shutdown or restart process to prevent this issue in Hyper-V? Alternatively, could the problem be resolved by modifying the startup or logon scripts, for instance, by adding conditions to verify if an actual login has occurred? Any ideas or suggestions to explain or resolve this behavior would be greatly appreciated.
Admin account Lockout
Hi All - I have been asked to implement password chages ppoicy at a site we support. During this process I also setup account lockout policy after 5 invalid attempts The option Allow Administrator Account lockout was enabled and now when trying to login I have the message - The referenced account is currently locked out and may not be logged onto. We have only used the correct password to logon - but this still has happened and waiting 30mins does not sort this issue. Also, I have no other Administrator account for this Domain Server. Does anyone have any suggestions on dealing with this ? The Policy has the following settings - Account Lockout Duration 30mins Account Lockout Threshold 5 Invalid logon attemps Allow Administrator Lockout Enabled Reset Account loclout Counter after 30mins
